1     /*
2  * Copyright (C) 2021 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *     http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "gap_le.h"
17 #include "gap_internal.h"
18 
19 #include <securec.h>
20 
21 #include "allocator.h"
22 #include "log.h"
23 #include "thread.h"
24 
25 #include "btm.h"
26 #include "btm/btm_thread.h"
27 
28 typedef enum {
29     SIGNATURE_GENERATION,
30     SIGNATURE_CONFIRMATION,
31 } SignatureType;
32 
33 typedef struct {
34     uint16_t handle;
35     uint8_t type;
36     uint32_t counter;
37     uint8_t signature[GAP_SIGNATURE_SIZE];
38     GAP_SignatureResult result;
39     bool processing;
40     void *callback;
41     void *context;
42 } SignatureRequestInfo;
43 
44 typedef struct {
45     GapLePairCallback callback;
46     void *context;
47 } LePairCallback;
48 
49 typedef struct {
50     GapLeSecurityCallback callback;
51     void *context;
52 } LeSecurityCallback;
53 
54 static LePairCallback g_lePairCallback;
55 static LeSecurityCallback g_leSecurityCallback;
56 
57 static int GapLePair(const BtAddr *addr);
58 
GapLeSecurityNeedAuthentication(const LeLocalInfo * localInfo)59 static bool GapLeSecurityNeedAuthentication(const LeLocalInfo *localInfo)
60 {
61     return localInfo->mode1Level >= LE_MODE_1_LEVEL_3 || localInfo->mode2Level >= LE_MODE_2_LEVEL_2;
62 }
63 
GapDoLeSecurityCallback(const void * data)64 void GapDoLeSecurityCallback(const void *data)
65 {
66     uint16_t handle = 0;
67     GapLeRequestSecurityResult callback = NULL;
68     void *context = NULL;
69     uint8_t result;
70     uint8_t encryptionStatus = GAP_LE_NO_ENCRYPTION;
71 
72     if (data == NULL) {
73         return;
74     } else {
75         handle = *(const uint16_t *)data;
76     }
77 
78     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
79     LeDeviceInfo *deviceInfo = NULL;
80     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
81     if (deviceInfo != NULL && deviceInfo->securityReq != NULL) {
82         callback = deviceInfo->securityReq->callback;
83         context = deviceInfo->securityReq->context;
84         result = deviceInfo->securityReq->result;
85         MEM_MALLOC.free(deviceInfo->securityReq);
86         deviceInfo->securityReq = NULL;
87     }
88 
89     if (deviceInfo != NULL) {
90         encryptionStatus = deviceInfo->encryptionStatus;
91         if (callback != NULL) {
92             callback(&deviceInfo->addr, result, encryptionStatus, context);
93         }
94     }
95 }
96 
GapLePasskeyRequestProcess(const BtAddr * addr,uint16_t handle,uint8_t pairMethod,const void * displayValue)97 static void GapLePasskeyRequestProcess(
98     const BtAddr *addr, uint16_t handle, uint8_t pairMethod, const void *displayValue)
99 {
100     int ret;
101 
102     if (pairMethod == SMP_PAIR_METHOD_PASSKEY_DISPLAY) {
103         if (g_lePairCallback.callback.lePairPassKeyNotification) {
104             g_lePairCallback.callback.lePairPassKeyNotification(
105                 addr, *(uint32_t *)displayValue, g_lePairCallback.context);
106             ret = SMP_AuthenticationRequestReply(handle, true, 0x00, pairMethod, displayValue);
107             if (ret != BT_SUCCESS) {
108                 LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
109             }
110         } else {
111             ret = SMP_AuthenticationRequestReply(handle, false, SMP_PAIR_FAILED_UNSPECIFIED_REASION, pairMethod, NULL);
112             if (ret != BT_SUCCESS) {
113                 LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
114             }
115         }
116     } else if (pairMethod == SMP_PAIR_METHOD_PASSKEY_ENTRY) {
117         if (g_lePairCallback.callback.lePairPassKeyReq) {
118             g_lePairCallback.callback.lePairPassKeyReq(addr, g_lePairCallback.context);
119         } else {
120             ret = SMP_AuthenticationRequestReply(handle, false, SMP_PAIR_FAILED_UNSPECIFIED_REASION, pairMethod, NULL);
121             if (ret != BT_SUCCESS) {
122                 LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
123             }
124         }
125     }
126 }
127 
GapLeUserConfirmProcess(const BtAddr * addr,uint16_t handle,uint8_t pairMethod,const void * displayValue)128 static void GapLeUserConfirmProcess(const BtAddr *addr, uint16_t handle, uint8_t pairMethod, const void *displayValue)
129 {
130     if (g_lePairCallback.callback.lePairScUserConfirmReq) {
131         g_lePairCallback.callback.lePairScUserConfirmReq(addr, *(uint32_t *)displayValue, g_lePairCallback.context);
132     } else {
133         int ret = SMP_AuthenticationRequestReply(handle, false, SMP_PAIR_FAILED_UNSPECIFIED_REASION, pairMethod, NULL);
134         if (ret != BT_SUCCESS) {
135             LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
136         }
137     }
138 }
139 
GapLeLegacyOOBProcess(const BtAddr * addr,uint16_t handle,uint8_t pairMethod,const void * displayValue)140 static void GapLeLegacyOOBProcess(const BtAddr *addr, uint16_t handle, uint8_t pairMethod, const void *displayValue)
141 {
142     if (g_lePairCallback.callback.lePairOobReq) {
143         g_lePairCallback.callback.lePairOobReq(addr, g_lePairCallback.context);
144     } else {
145         int ret = SMP_AuthenticationRequestReply(handle, false, SMP_PAIR_FAILED_UNSPECIFIED_REASION, pairMethod, NULL);
146         if (ret != BT_SUCCESS) {
147             LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
148         }
149     }
150 }
151 
GapLeSecureConnectionOOBProcess(const BtAddr * addr,uint16_t handle,uint8_t pairMethod,const void * displayValue)152 static void GapLeSecureConnectionOOBProcess(
153     const BtAddr *addr, uint16_t handle, uint8_t pairMethod, const void *displayValue)
154 {
155     int ret;
156     bool accept = true;
157 
158     if (pairMethod == SMP_PAIR_METHOD_OOB_SC_LOCAL_SEND_PEER_RECV ||
159         pairMethod == SMP_PAIR_METHOD_OOB_SC_BOTH_SIDE_SEND_RECV) {
160         if (g_lePairCallback.callback.lePairScOobNotification) {
161             GapOOBData oobData;
162             const uint8_t *data = displayValue;
163             if (memcpy_s(oobData.R,
164                 GAP_OOB_DATA_RANDOM_SIZE, data + BT_ADDRESS_SIZE, GAP_OOB_DATA_RANDOM_SIZE) != EOK) {
165                     LOG_WARN("%{public}s: memcpy_s oobData.R fail.", __FUNCTION__);
166                     return;
167                 }
168             if (memcpy_s(oobData.C,
169                 GAP_OOB_DATA_CONFIRM_SIZE,
170                 data + BT_ADDRESS_SIZE + GAP_OOB_DATA_RANDOM_SIZE,
171                 GAP_OOB_DATA_CONFIRM_SIZE) != EOK) {
172                     LOG_WARN("%{public}s: memcpy_s fail.", __FUNCTION__);
173                     return;
174                 }
175             g_lePairCallback.callback.lePairScOobNotification(addr, &oobData, g_lePairCallback.context);
176         } else {
177             accept = false;
178         }
179     }
180 
181     if (pairMethod == SMP_PAIR_METHOD_OOB_SC_LOCAL_RECV_PEER_SEND ||
182         pairMethod == SMP_PAIR_METHOD_OOB_SC_BOTH_SIDE_SEND_RECV) {
183         if (g_lePairCallback.callback.lePairScOobReq) {
184             g_lePairCallback.callback.lePairScOobReq(addr, g_lePairCallback.context);
185         } else {
186             accept = false;
187         }
188     }
189 
190     if (accept) {
191         if (pairMethod == SMP_PAIR_METHOD_OOB_SC_LOCAL_SEND_PEER_RECV) {
192             ret = SMP_AuthenticationRequestReply(handle, accept, 0x00, pairMethod, NULL);
193             if (ret != BT_SUCCESS) {
194                 LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
195             }
196         }
197     } else {
198         ret = SMP_AuthenticationRequestReply(handle, accept, 0x00, pairMethod, NULL);
199         if (ret != BT_SUCCESS) {
200             LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
201         }
202     }
203 }
204 
GapLeAuthenticationRequestProcess(BtAddr addr,uint16_t handle,uint8_t pairMethod,const uint8_t * displayValue)205 static void GapLeAuthenticationRequestProcess(
206     BtAddr addr, uint16_t handle, uint8_t pairMethod, const uint8_t *displayValue)
207 {
208     int ret;
209 
210     switch (pairMethod) {
211         case SMP_PAIR_METHOD_PASSKEY_DISPLAY:
212         case SMP_PAIR_METHOD_PASSKEY_ENTRY:
213             GapLePasskeyRequestProcess(&addr, handle, pairMethod, displayValue);
214             break;
215         case SMP_PAIR_METHOD_NUMERIC_COMPARISON:
216             GapLeUserConfirmProcess(&addr, handle, pairMethod, displayValue);
217             break;
218         case SMP_PAIR_METHOD_OOB_LEGACY:
219             GapLeLegacyOOBProcess(&addr, handle, pairMethod, displayValue);
220             break;
221         case SMP_PAIR_METHOD_JUST_WORK:
222             ret = SMP_AuthenticationRequestReply(handle, true, 0x00, pairMethod, NULL);
223             if (ret != BT_SUCCESS) {
224                 LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
225             }
226             break;
227         case SMP_PAIR_METHOD_OOB_SC_LOCAL_SEND_PEER_RECV:
228         case SMP_PAIR_METHOD_OOB_SC_LOCAL_RECV_PEER_SEND:
229         case SMP_PAIR_METHOD_OOB_SC_BOTH_SIDE_SEND_RECV:
230             GapLeSecureConnectionOOBProcess(&addr, handle, pairMethod, displayValue);
231             break;
232         default:
233             LOG_WARN("%{public}s:Invalid pair method:%hhu.", __FUNCTION__, pairMethod);
234             break;
235     }
236 }
237 
GapLeAuthenticationRequest(uint16_t handle,uint8_t pairMethod,const uint8_t * displayValue)238 void GapLeAuthenticationRequest(uint16_t handle, uint8_t pairMethod, const uint8_t *displayValue)
239 {
240     BtAddr addr = {0};
241     int ret;
242 
243     LeLocalInfo *localInfo = GapGetLeLocalInfo();
244     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
245     LeDeviceInfo *deviceInfo = NULL;
246     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
247     if (deviceInfo != NULL) {
248         (void)memcpy_s(&addr, sizeof(BtAddr), &deviceInfo->addr, sizeof(BtAddr));
249         deviceInfo->pairMethod = pairMethod;
250     }
251     if (deviceInfo != NULL) {
252         if (GapLeSecurityNeedAuthentication(localInfo) && pairMethod == SMP_PAIR_METHOD_JUST_WORK) {
253             ret = SMP_AuthenticationRequestReply(handle, false, SMP_PAIR_FAILED_AUTH_REQ, pairMethod, NULL);
254             if (ret != BT_SUCCESS) {
255                 LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
256             }
257             return;
258         }
259 
260         if (g_lePairCallback.callback.lePairMethodNotify) {
261             g_lePairCallback.callback.lePairMethodNotify(&addr, pairMethod, g_lePairCallback.context);
262         }
263         GapLeAuthenticationRequestProcess(addr, handle, pairMethod, displayValue);
264     } else {
265         ret = SMP_AuthenticationRequestReply(handle, false, SMP_PAIR_FAILED_UNSPECIFIED_REASION, pairMethod, NULL);
266         if (ret != BT_SUCCESS) {
267             LOG_WARN("%{public}s:pairMethod:%{public}d Call SMP failed:%{public}d.", __FUNCTION__, pairMethod, ret);
268         }
269     }
270 }
271 
GapLePairKeyConvert(const SMP_PairResult * result,LePairedKeys * keys)272 static void GapLePairKeyConvert(const SMP_PairResult *result, LePairedKeys *keys)
273 {
274     if (result->peerKeyDist | SMP_KEY_DIST_BIT_ENC_KEY) {
275         (void)memcpy_s(keys->remoteEncKey->ltk, GAP_LTK_SIZE, result->peerLTK, GAP_LTK_SIZE);
276         (void)memcpy_s(&keys->remoteEncKey->rand,
277             sizeof(keys->remoteEncKey->rand),
278             result->peerRandom,
279             sizeof(result->peerRandom));
280         keys->remoteEncKey->ediv = result->peerEdiv;
281         keys->remoteEncKey->keySize = result->encKeySize;
282     } else {
283         keys->remoteEncKey = NULL;
284     }
285 
286     if (result->peerKeyDist | SMP_KEY_DIST_BIT_ID_KEY) {
287         (void)memcpy_s(&keys->remoteIdKey->identityAddr, sizeof(BtAddr), &result->peerIdentAddr, sizeof(BtAddr));
288         (void)memcpy_s(keys->remoteIdKey->irk, GAP_IRK_SIZE, result->peerIRK, GAP_IRK_SIZE);
289     } else {
290         keys->remoteIdKey = NULL;
291     }
292 
293     if (result->peerKeyDist | SMP_KEY_DIST_BIT_SIGN_KEY) {
294         (void)memcpy_s(keys->remoteSignKey->csrk, GAP_CSRK_SIZE, result->peerCSRK, GAP_CSRK_SIZE);
295         keys->remoteSignKey->counter = 0;
296     } else {
297         keys->remoteSignKey = NULL;
298     }
299 
300     if (result->localKeyDist | SMP_KEY_DIST_BIT_ENC_KEY) {
301         (void)memcpy_s(keys->localEncKey->ltk, GAP_LTK_SIZE, result->localLTK, GAP_LTK_SIZE);
302         (void)memcpy_s(&keys->localEncKey->rand,
303             sizeof(keys->localEncKey->rand),
304             result->localRandom,
305             sizeof(result->localRandom));
306         keys->localEncKey->ediv = result->localEdiv;
307         keys->localEncKey->keySize = result->encKeySize;
308     } else {
309         keys->localEncKey = NULL;
310     }
311 
312     if (result->localKeyDist | SMP_KEY_DIST_BIT_SIGN_KEY) {
313         (void)memcpy_s(keys->localSignKey->csrk, GAP_CSRK_SIZE, result->localCSRK, GAP_CSRK_SIZE);
314         keys->localSignKey->counter = 0;
315     } else {
316         keys->localSignKey = NULL;
317     }
318 }
319 
GapCallbackKeyNotify(const BtAddr * addr,const SMP_PairResult * result)320 static void GapCallbackKeyNotify(const BtAddr *addr, const SMP_PairResult *result)
321 {
322     LeEncKey remoteEncKey;
323     LeIdKey remoteIdKey;
324     LeSignKey remoteSignKey;
325     LeEncKey localEncKey;
326     LeSignKey localSignKey;
327 
328     LePairedKeys keys;
329     keys.remoteEncKey = &remoteEncKey;
330     keys.remoteIdKey = &remoteIdKey;
331     keys.remoteSignKey = &remoteSignKey;
332     keys.localEncKey = &localEncKey;
333     keys.localSignKey = &localSignKey;
334 
335     GapLePairKeyConvert(result, &keys);
336 
337     if (g_lePairCallback.callback.lePairKeyNotify) {
338         g_lePairCallback.callback.lePairKeyNotify(addr, keys, g_lePairCallback.context);
339     }
340 }
341 
GapSetLeSigningInfo(uint16_t handle,const SMP_PairResult * result)342 static void GapSetLeSigningInfo(uint16_t handle, const SMP_PairResult *result)
343 {
344     LeDeviceInfo *deviceInfo =
345         ListForEachData(GapGetLeConnectionInfoBlock()->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
346     if (deviceInfo != NULL) {
347         if (result->localKeyDist & SMP_KEY_DIST_BIT_SIGN_KEY) {
348             deviceInfo->localSigningExists = true;
349             (void)memcpy_s(deviceInfo->localSigningInfo.csrk, GAP_CSRK_SIZE, result->localCSRK, GAP_CSRK_SIZE);
350             deviceInfo->localSigningInfo.counter = 0;
351         } else {
352             deviceInfo->localSigningExists = false;
353         }
354         if (result->peerKeyDist & SMP_KEY_DIST_BIT_SIGN_KEY) {
355             deviceInfo->remoteSigningExists = true;
356             (void)memcpy_s(deviceInfo->remoteSigningInfo.csrk, GAP_CSRK_SIZE, result->peerCSRK, GAP_CSRK_SIZE);
357             deviceInfo->remoteSigningInfo.counter = 0;
358         } else {
359             deviceInfo->remoteSigningExists = false;
360         }
361     }
362 }
363 
GapSetEncryptionStatusForPairEnd(LeDeviceInfo * deviceInfo,uint8_t status,const SMP_PairResult * result)364 static void GapSetEncryptionStatusForPairEnd(LeDeviceInfo *deviceInfo, uint8_t status, const SMP_PairResult *result)
365 {
366     if (status == SMP_PAIR_STATUS_SUCCESS) {
367         if (deviceInfo->encryptionStatus == GAP_LE_UNAUTHENTICATED_ENCRYPTION && result->authFlag) {
368             deviceInfo->encryptionStatus = GAP_LE_AUTHENTICATED_ENCRYPTION;
369         }
370     } else {
371         deviceInfo->encryptionStatus = GAP_LE_NO_ENCRYPTION;
372     }
373 }
374 
GapDoPairResultCallback(const BtAddr * addr,uint8_t status)375 void GapDoPairResultCallback(const BtAddr *addr, uint8_t status)
376 {
377     if (g_lePairCallback.callback.lePairComplete) {
378         g_lePairCallback.callback.lePairComplete(addr, status, 0, g_lePairCallback.context);
379     }
380 }
381 
GapLePairResult(uint16_t handle,uint8_t status,const SMP_PairResult * result)382 void GapLePairResult(uint16_t handle, uint8_t status, const SMP_PairResult *result)
383 {
384     BtAddr addr = {0};
385 
386     LeDeviceInfo *deviceInfo =
387         ListForEachData(GapGetLeConnectionInfoBlock()->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
388     if (deviceInfo != NULL) {
389         (void)memcpy_s(&addr, sizeof(BtAddr), &deviceInfo->addr, sizeof(BtAddr));
390         if (deviceInfo->securityStatus == GAP_LE_SECURITY_STATUS_PAIR) {
391             deviceInfo->securityStatus = GAP_LE_SECURITY_STATUS_IDLE;
392         }
393         GapSetEncryptionStatusForPairEnd(deviceInfo, status, result);
394         if (deviceInfo->securityReq != NULL) {
395             deviceInfo->securityReq->result = status;
396             GapDoLeSecurityCallback(&deviceInfo->handle);
397         }
398     }
399     bool isPairing = GapGetLeBondBlock()->isPairing;
400     if (deviceInfo == NULL && isPairing == true) {
401         (void)memcpy_s(&addr, sizeof(BtAddr), &GapGetLeBondBlock()->addr, sizeof(BtAddr));
402     }
403 
404     GapClearPairingStatus(&addr);
405 
406     if (deviceInfo != NULL || isPairing) {
407         if (status == SMP_PAIR_STATUS_SUCCESS && result->bondedFlag == SMP_BONDED_FLAG_YES) {
408             GapCallbackKeyNotify(&addr, result);
409             GapSetLeSigningInfo(handle, result);
410         }
411         if (g_lePairCallback.callback.lePairComplete) {
412             g_lePairCallback.callback.lePairComplete(&addr, status, result->authFlag, g_lePairCallback.context);
413         }
414     }
415 }
416 
GapLeRemotePairRequest(uint16_t handle,const SMP_PairParam * param)417 void GapLeRemotePairRequest(uint16_t handle, const SMP_PairParam *param)
418 {
419     BtAddr addr = {0};
420     int ret;
421 
422     if (GapGetLeLocalInfo()->minEncKeySize > param->maxEncKeySize) {
423         SMP_RemotePairRequestReply(handle, SMP_PAIR_FAILED_ENC_KEY_SIZE, NULL, NULL, NULL);
424         return;
425     }
426 
427     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
428     LeDeviceInfo *deviceInfo = NULL;
429     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
430     if (deviceInfo != NULL) {
431         (void)memcpy_s(&addr, sizeof(BtAddr), &deviceInfo->addr, sizeof(BtAddr));
432     }
433 
434     if (deviceInfo != NULL) {
435         if (g_lePairCallback.callback.lePairFeatureReq) {
436             g_lePairCallback.callback.lePairFeatureReq(
437                 &deviceInfo->addr, deviceInfo->isLocalSecurityRequest, g_lePairCallback.context);
438         } else {
439             ret = SMP_RemotePairRequestReply(handle, SMP_PAIR_FAILED_UNSPECIFIED_REASION, NULL, NULL, NULL);
440             if (ret != BT_SUCCESS) {
441                 LOG_WARN("%{public}s:SMP_RemotePairRequestReply failed:%{public}d.", __FUNCTION__, ret);
442             }
443         }
444     } else {
445         ret = SMP_RemotePairRequestReply(handle, SMP_PAIR_FAILED_UNSPECIFIED_REASION, NULL, NULL, NULL);
446         if (ret != BT_SUCCESS) {
447             LOG_WARN("%{public}s:SMP_RemotePairRequestReply failed:%{public}d.", __FUNCTION__, ret);
448         }
449     }
450 }
451 
GapLeRemotePairResponse(uint16_t handle,const SMP_PairParam * param)452 void GapLeRemotePairResponse(uint16_t handle, const SMP_PairParam *param)
453 {
454     if (GapGetLeLocalInfo()->minEncKeySize > param->maxEncKeySize) {
455         SMP_RemotePairResponseReply(handle, false, SMP_PAIR_FAILED_ENC_KEY_SIZE);
456         return;
457     }
458     LeLocalInfo *localInfo = GapGetLeLocalInfo();
459     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
460     LeDeviceInfo *deviceInfo = NULL;
461     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
462     if (deviceInfo != NULL) {
463         if (GapLeSecurityNeedAuthentication(localInfo) && !(param->authReq & SMP_AUTH_REQ_BIT_MITM)) {
464             SMP_RemotePairResponseReply(handle, false, SMP_PAIR_FAILED_AUTH_REQ);
465         } else {
466             SMP_RemotePairResponseReply(handle, true, 0x00);
467         }
468     } else {
469         SMP_RemotePairResponseReply(handle, false, SMP_PAIR_FAILED_UNSPECIFIED_REASION);
470     }
471 }
472 
GapLeRemoteSecurityRequest(uint16_t handle,uint8_t authReq)473 void GapLeRemoteSecurityRequest(uint16_t handle, uint8_t authReq)
474 {
475     BtAddr addr = {0};
476 
477     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
478     LeDeviceInfo *deviceInfo = NULL;
479     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
480     if (deviceInfo != NULL) {
481         (void)memcpy_s(&addr, sizeof(BtAddr), &deviceInfo->addr, sizeof(BtAddr));
482         deviceInfo->isRemoteSecurityRequest = true;
483     }
484 
485     if (g_leSecurityCallback.callback.leRemoteEncryptionKeyReqEvent) {
486         g_leSecurityCallback.callback.leRemoteEncryptionKeyReqEvent(&addr, g_leSecurityCallback.context);
487     } else {
488         int ret = SMP_RemoteSecurityRequestReply(handle, false, SMP_PAIR_FAILED_UNSPECIFIED_REASION);
489         if (ret != BT_SUCCESS) {
490             LOG_WARN("%{public}s:SMP_RemoteSecurityRequestReply failed:%{public}d.", __FUNCTION__, ret);
491         }
492     }
493 }
494 
GapLeLongTermKeyRequest(uint16_t handle,const uint8_t * random,uint16_t ediv)495 void GapLeLongTermKeyRequest(uint16_t handle, const uint8_t *random, uint16_t ediv)
496 {
497     BtAddr addr = {0};
498 
499     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
500     LeDeviceInfo *deviceInfo = NULL;
501     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
502     if (deviceInfo != NULL) {
503         (void)memcpy_s(&addr, sizeof(BtAddr), &deviceInfo->addr, sizeof(BtAddr));
504     }
505 
506     if (g_leSecurityCallback.callback.leLocalEncryptionKeyReqEvent) {
507         g_leSecurityCallback.callback.leLocalEncryptionKeyReqEvent(
508             &addr, *(uint64_t *)random, ediv, g_leSecurityCallback.context);
509     } else {
510         int ret = SMP_LongTermKeyRequestReply(handle, false, NULL);
511         if (ret != BT_SUCCESS) {
512             LOG_WARN("%{public}s:SMP_LongTermKeyRequestReply failed:%{public}d.", __FUNCTION__, ret);
513         }
514     }
515 }
516 
GapLeEncryptionComplete(uint16_t handle,uint8_t status)517 void GapLeEncryptionComplete(uint16_t handle, uint8_t status)
518 {
519     BtAddr addr = {0};
520 
521     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
522     LeDeviceInfo *deviceInfo = NULL;
523     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByHandle, &handle);
524     if (deviceInfo != NULL) {
525         (void)memcpy_s(&addr, sizeof(BtAddr), &deviceInfo->addr, sizeof(BtAddr));
526         if (status != HCI_SUCCESS) {
527             deviceInfo->encryptionStatus = GAP_LE_NO_ENCRYPTION;
528             if (deviceInfo->securityReq != NULL) {
529                 deviceInfo->securityReq->result = GAP_STATUS_FAILED;
530                 GapDoLeSecurityCallback(&handle);
531             }
532         } else {
533             if (deviceInfo->keyType == LE_KEY_TYPE_AUTHENTICATION) {
534                 deviceInfo->encryptionStatus = GAP_LE_AUTHENTICATED_ENCRYPTION;
535             } else {
536                 deviceInfo->encryptionStatus = GAP_LE_UNAUTHENTICATED_ENCRYPTION;
537             }
538         }
539     }
540 
541     if (deviceInfo != NULL && g_leSecurityCallback.callback.encryptionComplete) {
542         g_leSecurityCallback.callback.encryptionComplete(status, &addr, g_leSecurityCallback.context);
543     }
544 }
545 
GAP_RegisterLeSecurityCallback(const GapLeSecurityCallback * callback,void * context)546 int GAP_RegisterLeSecurityCallback(const GapLeSecurityCallback *callback, void *context)
547 {
548     LOG_INFO("%{public}s:%{public}s", __FUNCTION__, callback ? "register" : "NULL");
549     if (callback == NULL) {
550         (void)memset_s(&g_leSecurityCallback.callback,
551             sizeof(g_leSecurityCallback.callback),
552             0x00,
553             sizeof(g_leSecurityCallback.callback));
554     } else {
555         g_leSecurityCallback.callback = *callback;
556     }
557     g_leSecurityCallback.context = context;
558     return GAP_SUCCESS;
559 }
560 
GAP_DeregisterLeSecurityCallback(void)561 int GAP_DeregisterLeSecurityCallback(void)
562 {
563     (void)memset_s(&g_leSecurityCallback.callback,
564         sizeof(g_leSecurityCallback.callback),
565         0x00,
566         sizeof(g_leSecurityCallback.callback));
567     g_leSecurityCallback.context = NULL;
568     return GAP_SUCCESS;
569 }
570 
GAP_LeRemoteEncryptionKeyRsp(const BtAddr * addr,uint8_t accept,LeEncKey encKey,uint8_t keyType)571 int GAP_LeRemoteEncryptionKeyRsp(const BtAddr *addr, uint8_t accept, LeEncKey encKey, uint8_t keyType)
572 {
573     LOG_INFO("%{public}s:" BT_ADDR_FMT "accept:%hhu keyType:%hhu",
574         __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr), accept, keyType);
575 
576     if (GapIsLeEnable() == false) {
577         return GAP_ERR_NOT_ENABLE;
578     }
579 
580     int ret = GAP_ERR_INVAL_PARAM;
581     LeLocalInfo *localInfo = GapGetLeLocalInfo();
582     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
583     LeDeviceInfo *deviceInfo = NULL;
584     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
585     if (deviceInfo != NULL) {
586         if (accept == GAP_ACCEPT) {
587             deviceInfo->keyType = keyType;
588             deviceInfo->keySize = encKey.keySize;
589             if (deviceInfo->isRemoteSecurityRequest) {
590                 ret = SMP_RemoteSecurityRequestReply(deviceInfo->handle, true, 0x00);
591                 if (ret != BT_SUCCESS) {
592                     LOG_WARN("%{public}s:SMP_RemoteSecurityRequestReply failed:%{public}d.", __FUNCTION__, ret);
593                 }
594             }
595 
596             if (keyType == LE_KEY_TYPE_AUTHENTICATION) {
597                 ret = SMP_StartEncryption(deviceInfo->handle, (uint8_t *)&encKey.rand, encKey.ediv, encKey.ltk);
598             } else if (GapLeSecurityNeedAuthentication(localInfo)) {
599                 ret = GapLePair(addr);
600                 GapGetLeBondBlock()->isPairing = true;
601                 (void)memcpy_s(&GapGetLeBondBlock()->addr, sizeof(BtAddr), addr, sizeof(BtAddr));
602             } else {
603                 ret = SMP_StartEncryption(deviceInfo->handle, (uint8_t *)&encKey.rand, encKey.ediv, encKey.ltk);
604             }
605         } else if (accept == GAP_NOT_ACCEPT) {
606             ret = GapLePair(addr);
607             GapGetLeBondBlock()->isPairing = true;
608             (void)memcpy_s(&GapGetLeBondBlock()->addr, sizeof(BtAddr), addr, sizeof(BtAddr));
609         } else {
610             ret = GAP_ERR_INVAL_PARAM;
611         }
612     }
613 
614     return ret;
615 }
616 
GAP_LeLocalEncryptionKeyRsp(const BtAddr * addr,uint8_t accept,LeEncKey encKey,uint8_t keyType)617 int GAP_LeLocalEncryptionKeyRsp(const BtAddr *addr, uint8_t accept, LeEncKey encKey, uint8_t keyType)
618 {
619     LOG_INFO("%{public}s:" BT_ADDR_FMT "accept:%hhu keyType:%hhu",
620         __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr), accept, keyType);
621 
622     if (GapIsLeEnable() == false) {
623         return GAP_ERR_NOT_ENABLE;
624     }
625     int ret = GAP_ERR_INVAL_PARAM;
626     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
627     LeDeviceInfo *deviceInfo = NULL;
628     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
629     if (deviceInfo != NULL) {
630         deviceInfo->keyType = keyType;
631         deviceInfo->keySize = encKey.keySize;
632         if (accept == GAP_ACCEPT) {
633             ret = SMP_LongTermKeyRequestReply(deviceInfo->handle, true, encKey.ltk);
634         } else if (accept == GAP_NOT_ACCEPT) {
635             ret = SMP_LongTermKeyRequestReply(deviceInfo->handle, false, NULL);
636         } else {
637             ret = GAP_ERR_INVAL_PARAM;
638         }
639     }
640 
641     return ret;
642 }
643 
GAP_RequestSigningAlgorithmInfoRsp(const BtAddr * addr,uint8_t accept,GapSigningAlgorithmInfo info)644 int GAP_RequestSigningAlgorithmInfoRsp(const BtAddr *addr, uint8_t accept, GapSigningAlgorithmInfo info)
645 {
646     int ret = GAP_SUCCESS;
647     LOG_INFO("%{public}s:" BT_ADDR_FMT "accept:%hhu", __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr), accept);
648 
649     if (GapIsLeEnable() == false) {
650         return GAP_ERR_NOT_ENABLE;
651     }
652     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
653     LeDeviceInfo *deviceInfo = NULL;
654     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
655     if (deviceInfo != NULL) {
656         if (accept == GAP_ACCEPT) {
657             if (info.localKey != NULL) {
658                 deviceInfo->localSigningExists = true;
659                 deviceInfo->localSigningInfo = *info.localKey;
660             }
661             if (info.remoteKey != NULL) {
662                 deviceInfo->remoteSigningExists = true;
663                 deviceInfo->remoteSigningInfo = *info.remoteKey;
664             }
665         } else if (accept == GAP_NOT_ACCEPT) {
666             deviceInfo->localSigningExists = false;
667             deviceInfo->remoteSigningExists = false;
668         } else {
669             ret = GAP_ERR_INVAL_PARAM;
670         }
671     } else {
672         ret = GAP_ERR_INVAL_STATE;
673     }
674 
675     return ret;
676 }
677 
GapLeRequestSecurityMaster(const LeDeviceInfo * deviceInfo)678 static int GapLeRequestSecurityMaster(const LeDeviceInfo *deviceInfo)
679 {
680     int ret = GAP_SUCCESS;
681     bool isCalled = false;
682     const BtAddr *addr = &deviceInfo->addr;
683 
684     if (deviceInfo->encryptionStatus >= deviceInfo->securityReq->secReqStatus) {
685         deviceInfo->securityReq->callback(
686             &deviceInfo->addr, GAP_STATUS_SUCCESS, deviceInfo->encryptionStatus, deviceInfo->securityReq->context);
687         return ret;
688     }
689 
690     if (!isCalled) {
691         if (g_leSecurityCallback.callback.leRemoteEncryptionKeyReqEvent) {
692             g_leSecurityCallback.callback.leRemoteEncryptionKeyReqEvent(addr, g_leSecurityCallback.context);
693             isCalled = true;
694         }
695     }
696     if (!isCalled) {
697         if (g_lePairCallback.callback.lePairFeatureReq) {
698             g_lePairCallback.callback.lePairFeatureReq(
699                 addr, !deviceInfo->isRemoteSecurityRequest, g_lePairCallback.context);
700             isCalled = true;
701         }
702     }
703     if (!isCalled) {
704         ret = GAP_ERR_NOT_SUPPORT;
705     }
706 
707     return ret;
708 }
709 
GapLeRequestSecurityProcess(LeDeviceInfo * deviceInfo)710 int GapLeRequestSecurityProcess(LeDeviceInfo *deviceInfo)
711 {
712     int ret = GAP_SUCCESS;
713     uint8_t authReq = AUTH_REQ_DEFAULT;
714 
715     if (deviceInfo->securityStatus != GAP_LE_SECURITY_STATUS_IDLE) {
716         return ret;
717     }
718     if (deviceInfo->role == LE_CONNECTION_ROLE_MASTER) {
719         ret = GapLeRequestSecurityMaster(deviceInfo);
720     } else {
721         if (deviceInfo->securityReq != NULL && deviceInfo->securityReq->secReqStatus == GAP_LE_NO_ENCRYPTION) {
722             deviceInfo->securityReq->result = GAP_STATUS_SUCCESS;
723             GapDoLeSecurityCallback(&deviceInfo->handle);
724         } else if (deviceInfo->securityReq != NULL &&
725                    deviceInfo->securityReq->secReqStatus == GAP_LE_UNAUTHENTICATED_ENCRYPTION) {
726             authReq &= GapIsLeBondableMode() ? ~0 : ~SMP_AUTH_REQ_BONDING;
727         } else {
728             authReq &= GapIsLeBondableMode() ? ~0 : ~SMP_AUTH_REQ_BONDING;
729             authReq &= SMP_AUTH_REQ_BIT_MITM;
730         }
731 
732         deviceInfo->isLocalSecurityRequest = true;
733         ret = SMP_SendSecurityRequestToRemote(deviceInfo->handle, authReq);
734     }
735     return ret;
736 }
737 
GAP_LeRequestSecurity(const BtAddr * addr,GAP_LeSecurityStatus status,GapLeRequestSecurityResult callback,void * context)738 int GAP_LeRequestSecurity(
739     const BtAddr *addr, GAP_LeSecurityStatus status, GapLeRequestSecurityResult callback, void *context)
740 {
741     LOG_INFO("%{public}s:" BT_ADDR_FMT " status:%{public}d", __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr), status);
742     int ret;
743 
744     if (GapIsLeEnable() == false) {
745         return GAP_ERR_NOT_ENABLE;
746     }
747 
748     LeDeviceInfo *deviceInfo =
749         ListForEachData(GapGetLeConnectionInfoBlock()->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
750     if (deviceInfo != NULL && deviceInfo->securityReq == NULL) {
751         deviceInfo->securityReq = MEM_MALLOC.alloc(sizeof(LeSecurityReq));
752         if (deviceInfo->securityReq != NULL) {
753             deviceInfo->securityReq->secReqStatus = status;
754             deviceInfo->securityReq->callback = callback;
755             deviceInfo->securityReq->context = context;
756 
757             ret = GapLeRequestSecurityProcess(deviceInfo);
758         } else {
759             ret = GAP_ERR_OUT_OF_RES;
760         }
761     } else {
762         ret = GAP_ERR_INVAL_STATE;
763     }
764 
765     return ret;
766 }
767 
GapDoLePairFeatureReqCallback(void * data)768 static void GapDoLePairFeatureReqCallback(void *data)
769 {
770     LeDeviceInfo *deviceInfo = data;
771 
772     if (g_lePairCallback.callback.lePairFeatureReq) {
773         g_lePairCallback.callback.lePairFeatureReq(
774             &deviceInfo->addr, !deviceInfo->isRemoteSecurityRequest, g_lePairCallback.context);
775     }
776 }
777 
GAP_RegisterLePairCallback(const GapLePairCallback * callback,void * context)778 int GAP_RegisterLePairCallback(const GapLePairCallback *callback, void *context)
779 {
780     LOG_INFO("%{public}s:%{public}s", __FUNCTION__, callback ? "register" : "NULL");
781     if (callback == NULL) {
782         (void)memset_s(
783             &g_lePairCallback.callback, sizeof(g_lePairCallback.callback), 0x00, sizeof(g_lePairCallback.callback));
784     } else {
785         g_lePairCallback.callback = *callback;
786     }
787     g_lePairCallback.context = context;
788     return GAP_SUCCESS;
789 }
790 
GAP_DeregisterLePairCallback(void)791 int GAP_DeregisterLePairCallback(void)
792 {
793     (void)memset_s(
794         &g_lePairCallback.callback, sizeof(g_lePairCallback.callback), 0x00, sizeof(g_lePairCallback.callback));
795     g_lePairCallback.context = NULL;
796     return GAP_SUCCESS;
797 }
798 
GapClearPairingStatus(const BtAddr * addr)799 void GapClearPairingStatus(const BtAddr *addr)
800 {
801     LeBondBlock *leBondBlock = GapGetLeBondBlock();
802     if (GapAddrCompare(addr, &leBondBlock->addr)) {
803         leBondBlock->isPairing = false;
804     }
805 }
806 
GapLePair(const BtAddr * addr)807 static int GapLePair(const BtAddr *addr)
808 {
809     int ret = GAP_SUCCESS;
810     LeConnectionInfoBlock *connectionInfoBlock = NULL;
811     LeDeviceInfo *deviceInfo = NULL;
812     uint8_t authReq = AUTH_REQ_DEFAULT;
813     BtmLocalVersionInformation version;
814 
815     BTM_GetLocalVersionInformation(&version);
816     if (version.hciVersion < BLUETOOTH_CORE_SPECIFICATION_4_2) {
817         authReq &= ~SMP_AUTH_REQ_BIT_SC;
818     }
819 
820     connectionInfoBlock = GapGetLeConnectionInfoBlock();
821     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
822     if (deviceInfo != NULL) {
823         if (deviceInfo->securityStatus == GAP_LE_SECURITY_STATUS_IDLE) {
824             deviceInfo->securityStatus = GAP_LE_SECURITY_STATUS_PAIR;
825             if (deviceInfo->role == LE_CONNECTION_ROLE_MASTER) {
826                 GapDoLePairFeatureReqCallback(deviceInfo);
827             } else {
828                 deviceInfo->isLocalSecurityRequest = true;
829                 SMP_SendSecurityRequestToRemote(deviceInfo->handle, authReq);
830             }
831         } else {
832             ret = GAP_ERR_INVAL_STATE;
833         }
834     } else {
835         ret = GAP_ERR_INVAL_PARAM;
836     }
837 
838     return ret;
839 }
840 
GapLeDoPair(const void * addr)841 void GapLeDoPair(const void *addr)
842 {
843     int ret = GapLePair(addr);
844     if (ret != BT_SUCCESS) {
845         LOG_WARN("GapLePair ret = %{public}d", ret);
846     }
847 }
848 
GAP_LePair(const BtAddr * addr)849 int GAP_LePair(const BtAddr *addr)
850 {
851     int ret;
852 
853     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
854 
855     if (GapIsLeEnable() == false) {
856         return GAP_ERR_NOT_ENABLE;
857     }
858 
859     LeBondBlock *leBondBlock = GapGetLeBondBlock();
860     if (leBondBlock->isPairing) {
861         ret = GAP_ERR_INVAL_STATE;
862     } else {
863         LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
864         LeDeviceInfo *deviceInfo = NULL;
865         deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
866         if (deviceInfo != NULL) {
867             ret = GapLePair(addr);
868         } else {
869             ret = BTM_LeConnect(addr);
870         }
871         leBondBlock->isPairing = true;
872         (void)memcpy_s(&leBondBlock->addr, sizeof(BtAddr), addr, sizeof(BtAddr));
873     }
874 
875     return ret;
876 }
877 
GAP_LeCancelPair(const BtAddr * addr)878 int GAP_LeCancelPair(const BtAddr *addr)
879 {
880     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
881 
882     if (GapIsLeEnable() == false) {
883         return GAP_ERR_NOT_ENABLE;
884     }
885 
886     LeBondBlock *leBondBlock = GapGetLeBondBlock();
887     if (!leBondBlock->isPairing) {
888         LOG_WARN("%{public}s: invalid state", __FUNCTION__);
889     }
890     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
891     LeDeviceInfo *deviceInfo = NULL;
892     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
893     if (deviceInfo != NULL) {
894         return SMP_CancelPair(deviceInfo->handle);
895     } else {
896         return BTM_LeCancelConnect(addr);
897     }
898 }
899 
GAP_LeSetMinEncKeySize(uint8_t minSize)900 int GAP_LeSetMinEncKeySize(uint8_t minSize)
901 {
902     LeLocalInfo *localInfo = NULL;
903 
904     LOG_INFO("%{public}s: min key size:%hhu", __FUNCTION__, minSize);
905 
906     if (GapIsLeEnable() == false) {
907         return GAP_ERR_NOT_ENABLE;
908     }
909 
910     localInfo = GapGetLeLocalInfo();
911     localInfo->minEncKeySize = minSize;
912 
913     return GAP_SUCCESS;
914 }
915 
GAP_LePairFeatureRsp(const BtAddr * addr,GapLePairFeature localFeature)916 int GAP_LePairFeatureRsp(const BtAddr *addr, GapLePairFeature localFeature)
917 {
918     int ret;
919     LeLocalInfo *localInfo = NULL;
920     LeConnectionInfoBlock *connectionInfoBlock = NULL;
921     LeDeviceInfo *deviceInfo = NULL;
922 
923     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
924 
925     if (GapIsLeEnable() == false) {
926         return GAP_ERR_NOT_ENABLE;
927     }
928 
929     localInfo = GapGetLeLocalInfo();
930     connectionInfoBlock = GapGetLeConnectionInfoBlock();
931 
932     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
933     if (deviceInfo != NULL) {
934         if (localInfo->bondableMode == GAP_BONDABLE_MODE_NON) {
935             localFeature.authReq &= ~SMP_AUTH_REQ_BONDING;
936             localFeature.initKeyDis &= (deviceInfo->role == LE_CONNECTION_ROLE_MASTER) ? GAP_LE_KEY_DIST_ID_KEY : 0;
937             localFeature.respKeyDis &= (deviceInfo->role == LE_CONNECTION_ROLE_SLAVE) ? GAP_LE_KEY_DIST_ID_KEY : 0;
938         }
939 
940         if (deviceInfo->securityReq && deviceInfo->securityReq->secReqStatus == GAP_LE_AUTHENTICATED_ENCRYPTION) {
941             localFeature.authReq |= SMP_AUTH_REQ_BIT_MITM;
942         }
943 
944         BtmLocalVersionInformation version;
945         BTM_GetLocalVersionInformation(&version);
946         if (version.hciVersion < BLUETOOTH_CORE_SPECIFICATION_4_2) {
947             localFeature.authReq &= ~SMP_AUTH_REQ_BIT_SC;
948         }
949 
950         SMP_PairParam pairParam = {
951             .ioCapability = localFeature.ioCapability,
952             .oobDataFlag = localFeature.oobDataFlag,
953             .authReq = localFeature.authReq,
954             .maxEncKeySize = localFeature.maxEncKeySize,
955             .initKeyDist = localFeature.initKeyDis,
956             .respKeyDist = localFeature.respKeyDis,
957         };
958 
959         if (deviceInfo->role == LE_CONNECTION_ROLE_MASTER) {
960             ret = SMP_StartPair(deviceInfo->handle, &deviceInfo->ownAddr, &deviceInfo->peerAddr, &pairParam);
961         } else {
962             ret = SMP_RemotePairRequestReply(
963                 deviceInfo->handle, SMP_PAIR_FAILED_NO_FAILED, &deviceInfo->ownAddr, &deviceInfo->peerAddr, &pairParam);
964         }
965     } else {
966         ret = GAP_ERR_INVAL_STATE;
967     }
968 
969     return ret;
970 }
GAP_LePairPassKeyRsp(const BtAddr * addr,uint8_t accept,uint32_t number)971 int GAP_LePairPassKeyRsp(const BtAddr *addr, uint8_t accept, uint32_t number)
972 {
973     LOG_INFO("%{public}s:", __FUNCTION__);
974     int ret;
975     LeConnectionInfoBlock *connectionInfoBlock = NULL;
976     LeDeviceInfo *deviceInfo = NULL;
977 
978     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
979 
980     if (GapIsLeEnable() == false) {
981         return GAP_ERR_NOT_ENABLE;
982     }
983 
984     connectionInfoBlock = GapGetLeConnectionInfoBlock();
985     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
986     if (deviceInfo != NULL) {
987         if (accept == GAP_ACCEPT) {
988             ret = SMP_AuthenticationRequestReply(
989                 deviceInfo->handle, true, 0x00, deviceInfo->pairMethod, (uint8_t *)&number);
990         } else if (accept == GAP_NOT_ACCEPT) {
991             ret = SMP_AuthenticationRequestReply(
992                 deviceInfo->handle, false, SMP_PAIR_FAILED_PASSKEY_ENTRY, deviceInfo->pairMethod, NULL);
993         } else {
994             ret = GAP_ERR_INVAL_PARAM;
995         }
996     } else {
997         ret = GAP_ERR_INVAL_PARAM;
998     }
999 
1000     return ret;
1001 }
GAP_LePairOobRsp(const BtAddr * addr,uint8_t accept,uint8_t oobData[GAP_OOB_DATA_SIZE])1002 int GAP_LePairOobRsp(const BtAddr *addr, uint8_t accept, uint8_t oobData[GAP_OOB_DATA_SIZE])
1003 {
1004     LOG_INFO("%{public}s:", __FUNCTION__);
1005     int ret;
1006     LeConnectionInfoBlock *connectionInfoBlock = NULL;
1007     LeDeviceInfo *deviceInfo = NULL;
1008 
1009     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
1010 
1011     if (GapIsLeEnable() == false) {
1012         return GAP_ERR_NOT_ENABLE;
1013     }
1014 
1015     connectionInfoBlock = GapGetLeConnectionInfoBlock();
1016     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
1017     if (deviceInfo != NULL) {
1018         if (accept == GAP_ACCEPT) {
1019             ret = SMP_AuthenticationRequestReply(deviceInfo->handle, true, 0x00, deviceInfo->pairMethod, oobData);
1020         } else if (accept == GAP_NOT_ACCEPT) {
1021             ret = SMP_AuthenticationRequestReply(
1022                 deviceInfo->handle, false, SMP_PAIR_FAILED_OOB_NOT_AVAILABLE, deviceInfo->pairMethod, NULL);
1023         } else {
1024             ret = GAP_ERR_INVAL_PARAM;
1025         }
1026     } else {
1027         ret = GAP_ERR_INVAL_PARAM;
1028     }
1029 
1030     return ret;
1031 }
1032 
GAP_LePairScOobRsp(const BtAddr * addr,uint8_t accept,const uint8_t oobDataC[GAP_OOB_DATA_SIZE],const uint8_t oobDataR[GAP_OOB_DATA_SIZE])1033 int GAP_LePairScOobRsp(const BtAddr *addr, uint8_t accept, const uint8_t oobDataC[GAP_OOB_DATA_SIZE],
1034     const uint8_t oobDataR[GAP_OOB_DATA_SIZE])
1035 {
1036     LOG_INFO("%{public}s:", __FUNCTION__);
1037     int ret;
1038     LeConnectionInfoBlock *connectionInfoBlock = NULL;
1039     LeDeviceInfo *deviceInfo = NULL;
1040 
1041     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
1042 
1043     if (GapIsLeEnable() == false) {
1044         return GAP_ERR_NOT_ENABLE;
1045     }
1046 
1047     connectionInfoBlock = GapGetLeConnectionInfoBlock();
1048     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
1049     if (deviceInfo != NULL) {
1050         if (accept == GAP_ACCEPT) {
1051             const int length = BT_ADDRESS_SIZE + GAP_OOB_DATA_RANDOM_SIZE + GAP_OOB_DATA_CONFIRM_SIZE;
1052             uint8_t smData[BT_ADDRESS_SIZE + GAP_OOB_DATA_RANDOM_SIZE + GAP_OOB_DATA_CONFIRM_SIZE] = {0};
1053             int offset = 0;
1054             (void)memcpy_s(smData + offset, length - offset, deviceInfo->peerAddr.addr, BT_ADDRESS_SIZE);
1055             offset += BT_ADDRESS_SIZE;
1056             (void)memcpy_s(smData + offset, length - offset, oobDataR, GAP_OOB_DATA_RANDOM_SIZE);
1057             offset += GAP_OOB_DATA_RANDOM_SIZE;
1058             (void)memcpy_s(smData + offset, length - offset, oobDataC, GAP_OOB_DATA_CONFIRM_SIZE);
1059 
1060             ret = SMP_AuthenticationRequestReply(deviceInfo->handle, true, 0x00, deviceInfo->pairMethod, smData);
1061         } else if (accept == GAP_NOT_ACCEPT) {
1062             ret = SMP_AuthenticationRequestReply(
1063                 deviceInfo->handle, false, SMP_PAIR_FAILED_NUMERIC_COMPARISON, deviceInfo->pairMethod, NULL);
1064         } else {
1065             ret = GAP_ERR_INVAL_PARAM;
1066         }
1067     } else {
1068         ret = GAP_ERR_INVAL_STATE;
1069     }
1070 
1071     return ret;
1072 }
GAP_LePairScUserConfirmRsp(const BtAddr * addr,uint8_t accept)1073 int GAP_LePairScUserConfirmRsp(const BtAddr *addr, uint8_t accept)
1074 {
1075     LOG_INFO("%{public}s:", __FUNCTION__);
1076     int ret;
1077     LeConnectionInfoBlock *connectionInfoBlock = NULL;
1078     LeDeviceInfo *deviceInfo = NULL;
1079 
1080     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
1081 
1082     if (GapIsLeEnable() == false) {
1083         return GAP_ERR_NOT_ENABLE;
1084     }
1085 
1086     connectionInfoBlock = GapGetLeConnectionInfoBlock();
1087     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
1088     if (deviceInfo != NULL) {
1089         if (accept == GAP_ACCEPT) {
1090             ret = SMP_AuthenticationRequestReply(deviceInfo->handle, true, 0x00, deviceInfo->pairMethod, NULL);
1091         } else if (accept == GAP_NOT_ACCEPT) {
1092             ret = SMP_AuthenticationRequestReply(
1093                 deviceInfo->handle, false, SMP_PAIR_FAILED_NUMERIC_COMPARISON, deviceInfo->pairMethod, NULL);
1094         } else {
1095             ret = GAP_ERR_INVAL_PARAM;
1096         }
1097     } else {
1098         ret = GAP_ERR_INVAL_STATE;
1099     }
1100 
1101     return ret;
1102 }
1103 
GapDoSignatureCallback(void * data)1104 void GapDoSignatureCallback(void *data)
1105 {
1106     SignatureRequestInfo *info = data;
1107 
1108     if (info->type == SIGNATURE_GENERATION) {
1109         GAPSignatureGenerationResult callback = info->callback;
1110         callback(info->result, info->signature, info->context);
1111     } else if (info->type == SIGNATURE_CONFIRMATION) {
1112         GAPSignatureConfirmationResult callback = info->callback;
1113         callback(info->result, info->context);
1114     }
1115 
1116     ListRemoveNode(GapGetLeSignatureBlock()->RequestList, data);
1117 }
1118 
GapAllocSignatureRequestInfo(uint16_t handle,SignatureType type,uint32_t counter,void * callback,void * context)1119 static SignatureRequestInfo *GapAllocSignatureRequestInfo(
1120     uint16_t handle, SignatureType type, uint32_t counter, void *callback, void *context)
1121 {
1122     SignatureRequestInfo *info = MEM_MALLOC.alloc(sizeof(SignatureRequestInfo));
1123     if (info != NULL) {
1124         info->handle = handle;
1125         info->callback = callback;
1126         info->context = context;
1127         info->type = type;
1128         info->processing = true;
1129         info->counter = counter;
1130     }
1131     return info;
1132 }
1133 
GAP_LeDataSignatureGeneration(const BtAddr * addr,GapSignatureData dataInfo,GAPSignatureGenerationResult callback,void * context)1134 int GAP_LeDataSignatureGeneration(
1135     const BtAddr *addr, GapSignatureData dataInfo, GAPSignatureGenerationResult callback, void *context)
1136 {
1137     if (callback == NULL) {
1138         return GAP_ERR_INVAL_PARAM;
1139     }
1140     uint8_t signature[GAP_SIGNATURE_SIZE] = {0};
1141     if (GapIsLeEnable() == false) {
1142         callback(GAP_SIGNATURE_ERR_EXECUTION, signature, context);
1143         return GAP_ERR_NOT_ENABLE;
1144     }
1145 
1146     if (addr == NULL) {
1147         callback(GAP_SIGNATURE_ERR_EXECUTION, signature, context);
1148         return GAP_ERR_INVAL_PARAM;
1149     }
1150 
1151     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
1152 
1153     int ret = GAP_ERR_INVAL_STATE;
1154     LeConnectionInfoBlock *connectionInfoBlock = GapGetLeConnectionInfoBlock();
1155     LeDeviceInfo *deviceInfo = NULL;
1156     deviceInfo = ListForEachData(connectionInfoBlock->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
1157     if (deviceInfo != NULL && deviceInfo->localSigningExists) {
1158         uint32_t counter = deviceInfo->localSigningInfo.counter;
1159         SignatureRequestInfo *info =
1160             GapAllocSignatureRequestInfo(deviceInfo->handle, SIGNATURE_GENERATION, counter, callback, context);
1161         if (info != NULL) {
1162             ListAddLast(GapGetLeSignatureBlock()->RequestList, info);
1163 
1164             ret = SMP_GenerateSignature(deviceInfo->localSigningInfo.csrk, counter, dataInfo.data, dataInfo.dataLen);
1165             if (ret != BT_SUCCESS) {
1166                 ListRemoveLast(GapGetLeSignatureBlock()->RequestList);
1167             }
1168         } else {
1169             ret = GAP_ERR_OUT_OF_RES;
1170         }
1171     }
1172 
1173     if (ret != BT_SUCCESS) {
1174         LOG_INFO("%{public}s: ret = %{public}d", __FUNCTION__, ret);
1175         callback(GAP_SIGNATURE_ERR_EXECUTION, signature, context);
1176     }
1177 
1178     return ret;
1179 }
1180 
GAP_LeDataSignatureConfirmation(const BtAddr * addr,GapSignatureData dataInfo,const uint8_t signature[GAP_SIGNATURE_SIZE],GAPSignatureConfirmationResult callback,void * context)1181 int GAP_LeDataSignatureConfirmation(const BtAddr *addr, GapSignatureData dataInfo,
1182     const uint8_t signature[GAP_SIGNATURE_SIZE], GAPSignatureConfirmationResult callback, void *context)
1183 {
1184     int ret = GAP_SUCCESS;
1185 
1186     LOG_INFO("%{public}s:" BT_ADDR_FMT, __FUNCTION__, BT_ADDR_FMT_OUTPUT(addr->addr));
1187 
1188     if (GapIsLeEnable() == false) {
1189         callback(GAP_SIGNATURE_ERR_EXECUTION, context);
1190         return GAP_ERR_NOT_ENABLE;
1191     }
1192 
1193     LeDeviceInfo *deviceInfo =
1194         ListForEachData(GapGetLeConnectionInfoBlock()->deviceList, GapFindLeConnectionDeviceByAddr, (void *)addr);
1195     if (deviceInfo != NULL && deviceInfo->remoteSigningExists) {
1196         uint32_t counter = *(uint32_t *)signature;
1197         SignatureRequestInfo *info =
1198             GapAllocSignatureRequestInfo(deviceInfo->handle, SIGNATURE_CONFIRMATION, counter, callback, context);
1199         if (info != NULL) {
1200             (void)memcpy_s(info->signature, GAP_SIGNATURE_SIZE, signature, GAP_SIGNATURE_SIZE);
1201             ListAddLast(GapGetLeSignatureBlock()->RequestList, info);
1202             if (deviceInfo->remoteSigningInfo.counter > counter) {
1203                 info->processing = false;
1204                 info->result = GAP_SIGNATURE_ERR_COUNTER;
1205                 GapDoSignatureCallback(info);
1206             } else {
1207                 ret =
1208                     SMP_GenerateSignature(deviceInfo->remoteSigningInfo.csrk, counter, dataInfo.data, dataInfo.dataLen);
1209             }
1210             if (ret != BT_SUCCESS) {
1211                 ListRemoveLast(GapGetLeSignatureBlock()->RequestList);
1212             }
1213         }
1214     } else {
1215         ret = GAP_ERR_INVAL_STATE;
1216     }
1217 
1218     if (ret != BT_SUCCESS) {
1219         LOG_INFO("%{public}s: ret = %{public}d", __FUNCTION__, ret);
1220         callback(GAP_SIGNATURE_ERR_EXECUTION, context);
1221     }
1222 
1223     return ret;
1224 }
1225 
GapDoCallbackSignCounterChange(SignatureRequestInfo * info)1226 static void GapDoCallbackSignCounterChange(SignatureRequestInfo *info)
1227 {
1228     LeSignKey *signKey = NULL;
1229     GAP_SignCounterType signCounterType = LOCAL_SIGN_COUNTER;
1230     LeDeviceInfo *deviceInfo =
1231         ListForEachData(GapGetLeConnectionInfoBlock()->deviceList, GapFindLeConnectionDeviceByHandle, &info->handle);
1232     if (deviceInfo != NULL) {
1233         if (info->type == SIGNATURE_GENERATION) {
1234             signKey = &deviceInfo->localSigningInfo;
1235             signCounterType = LOCAL_SIGN_COUNTER;
1236         } else if (info->type == SIGNATURE_CONFIRMATION) {
1237             signKey = &deviceInfo->remoteSigningInfo;
1238             signCounterType = REMOTE_SIGN_COUNTER;
1239         }
1240         if (signKey == NULL) {
1241             return;
1242         }
1243         signKey->counter = info->counter + 1;
1244 
1245         if (g_leSecurityCallback.callback.leSignCounterChangeNotification) {
1246             g_leSecurityCallback.callback.leSignCounterChangeNotification(
1247                 &deviceInfo->addr, signCounterType, signKey->counter, g_leSecurityCallback.context);
1248         }
1249     }
1250 }
1251 
GapLeGenerateSignatureResult(uint8_t status,const uint8_t * sign)1252 void GapLeGenerateSignatureResult(uint8_t status, const uint8_t *sign)
1253 {
1254     LOG_INFO("%{public}s: status:0x%02x", __FUNCTION__, status);
1255 
1256     List *list = GapGetLeSignatureBlock()->RequestList;
1257     ListNode *node = ListGetFirstNode(list);
1258     SignatureRequestInfo *info = NULL;
1259     while (node != 0) {
1260         info = ListGetNodeData(node);
1261         if (info != NULL && info->processing) {
1262             info->processing = false;
1263             break;
1264         }
1265         node = ListGetNextNode(node);
1266     }
1267 
1268     if (node != NULL) {
1269         if (status != SMP_GENERATE_SIGN_STATUS_SUCCESS) {
1270             info->result = GAP_SIGNATURE_ERR_EXECUTION;
1271         } else {
1272             if (info->type == SIGNATURE_CONFIRMATION && memcmp(sign, info->signature, GAP_SIGNATURE_SIZE)) {
1273                 info->result = GAP_SIGNATURE_ERR_ALGORITHM;
1274             } else {
1275                 (void)memcpy_s(info->signature, GAP_SIGNATURE_SIZE, sign, GAP_SIGNATURE_SIZE);
1276                 info->result = GAP_SIGNATURE_OK;
1277                 GapDoCallbackSignCounterChange(info);
1278             }
1279         }
1280 
1281         GapDoSignatureCallback(info);
1282     }
1283 }
1284 
GapRequestSigningAlgorithmInfo(const BtAddr * addr)1285 int GapRequestSigningAlgorithmInfo(const BtAddr *addr)
1286 {
1287     int ret;
1288     if (g_leSecurityCallback.callback.GapRequestSigningAlgorithmInfo) {
1289         g_leSecurityCallback.callback.GapRequestSigningAlgorithmInfo(addr, g_leSecurityCallback.context);
1290         ret = GAP_SUCCESS;
1291     } else {
1292         ret = GAP_ERR_NOT_SUPPORT;
1293     }
1294 
1295     return ret;
1296 }